CVE-2026-44284: FastGPT SSRF through stored internal MCP tool server URLs

Summary

FastGPT, an AI Agent building platform, prior to version 4.14.17, let authenticated users who can create or manage MCP toolsets save an internal MCP server URL, such as http://localhost:3000/mcp, through the MCP tool create and update endpoints. The direct MCP preview and run endpoints already rejected internal or private network URLs, so the protection was inconsistent. Later workflow execution used the stored URL without revalidating the destination, letting the FastGPT backend workflow runner connect to that internal destination.

Mitigation

Fixed in 4.14.17.

Topics

• AI agents
• Model Context Protocol

Related items

• MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
• MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
• MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database
• CriticalCVE-2026-58490: Tracecat SAML authentication bypass through unsigned responses in Docker ComposeSimilar attack · NVD/CVE Database